Which seems primarily concerned with making passwords hard to guess - which would be irrelevant if the primary form of attack was brute force. After all, "Pa$$word" and "Grea7 Gr33n 4rke$eizure£" would be equivalent in terms of a brute force attack, but I would guess that the NCSC would be rather more critical of the first than the second. For brute force attacks to be successful, the attacker needs two things - first, the actual password hash file, and second, enough time before the leaking of the hash file is discovered to go through the file and generate the hashes. If the organisation being attacked is honest and releases the information that the password file is out there as soon as it knows, the time between the initial leak and users changing their passwords is all that the hacker has.
As an extra precaution to slow down the attacker, the hash file could also contain a high proportion of dummy users with password hashes generated at random. That would throw an extra bit of grit in the hacker's works.